I'm trying to use the HAB to sign, and eventually encrypt & decrypt, a U-Boot image on a Nitrogen board. I've followed the instructions I've found so far, and I've created a U-Boot image from the U-Boot repository at git://github.com/boundarydevices/u-boot-imx6.git, using the production branch.
I've signed the image using the cst tool (ver 2.3.1), and I've examined the byte-codes in the resulting image, and everything looks good to me. I programmed the SPI flash on the board, and it boots U-Boot properly, but the hab_status command results in
U-Boot > hab_status
Secure boot disabled
HAB Configuration: 0xf0, HAB State: 0x66
--------- HAB Event 1 -----------------
event data:
0xdb 0x00 0x14 0x41 0x33 0x06 0xc0 0x00
0xbe 0x00 0x0c 0x00 0x09 0x17 0x00 0x02
0x00 0x00 0x11 0x00
--------- HAB Event 2 -----------------
event data:
0xdb 0x00 0x14 0x41 0x33 0x0c 0xa0 0x00
0x00 0x00 0x00 0x00 0x17 0x7f 0xf4 0x00
0x00 0x00 0x00 0x20
--------- HAB Event 3 -----------------
event data:
0xdb 0x00 0x14 0x41 0x33 0x0c 0xa0 0x00
0x00 0x00 0x00 0x00 0x17 0x7f 0xf4 0x2c
0x00 0x00 0x03 0x18
--------- HAB Event 4 -----------------
event data:
0xdb 0x00 0x14 0x41 0x33 0x0c 0xa0 0x00
0x00 0x00 0x00 0x00 0x17 0x7f 0xf4 0x20
0x00 0x00 0x00 0x01
--------- HAB Event 5 -----------------
event data:
0xdb 0x00 0x14 0x41 0x33 0x0c 0xa0 0x00
0x00 0x00 0x00 0x00 0x17 0x80 0x00 0x00
0x00 0x00 0x00 0x04
U-Boot >
Now those seem to be problems (HAB_INV_COMMAND and HAB_INV_ASSERTIONs), and I'm stuck as to how to proceed. I've replicated the same issue using the main-line U-Boot distro and the Freescale one, so I'm sure it's something I'm doing or not doing. I can provide more detail on any portion of this, but I was hoping for some advice on how to proceed before I start burning fuses and such.
